The envpack-conf 1.0.1 npm package is a malicious trojanized clone of the pkg-conf utility. It injects a top-level asynchronous immediately-invoked function expression (IIFE) that activates on module import. This IIFE queries several public Ethereum RPC endpoints for transactions sent from the attacker's Ethereum address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a. It decodes the 'to' field of these transactions into two IPv4 addresses, then fetches an XOR-encrypted payload from these addresses at the path /0x/cls. The payload is decrypted and executed using both eval() and a detached Node.js child process, allowing persistent and stealthy execution on the host. The package name and metadata impersonate the legitimate pkg-conf package and its maintainer, using typosquatting and obfuscation to evade static analysis.

This trojanized package can execute arbitrary code on any system that imports it, potentially leading to full compromise of the host environment. The malicious payload is fetched dynamically and executed in a detached process, enabling stealthy persistence. The obfuscation and impersonation increase the risk of inadvertent installation by developers relying on the legitimate pkg-conf package, potentially spreading the compromise in development and production environments.

No official patch or remediation is currently documented. Users should immediately remove envpack-conf version 1.0.1 from their projects and replace it with the legitimate pkg-conf package from trusted sources. Verify package integrity and authenticity before installation. Monitor for any unexpected child processes or network connections related to Ethereum RPC endpoints. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.